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An ongoing information operation is using a network of bots made up of newly created and stolen 
accounts to target a businessman, exiled from China, who has spoken critically of China's response to 
COVID-19. 

Yet identifying the network has revealed a much larger operation amplifying content across multiple 
languages, platforms, countries, and topics, with links to information operations against protests in Hong 
Kong, as well as involving cryptocurrency, coronavirus disinformation, and the most significant of all, the 
long-standing targeting of Guo Wengui, an exiled Chinese businessman residing in the United States. 

Over a period of nine days, I captured data from Twitter, both in real-time and past, and conducted an 
ongoing analysis of the dataset as it grew. This report will show the initial findings from the dataset. 

The findings indicate that there is a well-structured information campaign displaying a number of criteria 
similar to those of past campaigns identified as "significant state-backed information operations" 
originating from within the People's Republic of China (PRC) in a disclosure report bv Twitter 
( https://blo a .twitter.com/en us/topics/companv/2019/information operations directed at Hon g Kon q .html 
in August 2019. 

This report does not focus on the veracity of the targets of the information operation, nor does it seek to 
discredit or support the claims presented herein. The analysis is on the structure and operations of the 
network alone. 

Methodology: Capturing Data And Conducting The Analysis 
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The dataset was made by capturing activity from Twitter over a period from 25 April - 3 May, 2020.1 
captured data that was based on two hashtags that were present in many of the tweets: 


• #milesguo 


Here is an example of the content and style of the tweets: 
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( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen1. pna) 

The data around these hashtags was captured in real-time using the open source platform Geohi 
( https:// ae phi.or g/). and historical data was also captured for accounts and tags using the Python tool 
Twint (https:// a ithub.com/twintpro i ect/twint ). 


The data that was captured consisted of tweets, retweets, likes, comments, and mentions. 


In total, more than 2500 accounts were collected, which forms the basis of this analysis. 

While the dataset is large enough to identify trends, there is the limitation of time, location, account 
history, and details only Twitter is privy to. 

Given more time spent capturing this data in the same manner, or given a chance that Twitter would 
publish account details in its regular transparency reports, a more complete picture of the network could 
be analysed. 
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However, the following evidence is what is present in this existing dataset, and it is already very 
interesting. 

Visualising The Network: The Modularity Graph 

The data captured was visualised in Gephi (https:// qe phi.or g/). Using both modularity and hit detections 
automatically categorised the accounts into modularity classes and allowed for clusters to be formed 
based on their interractions in the network. You can see these clusters in the overview below. 



( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen2. pna) 
In the visualisation above there are two important features present: 


• The coloured dots, which are referred to as nodes' signify individual Twitter accounts 

• The lines between them, which are referred to as edges, are the interactions between the accounts 

Of the 2504 accounts, there were 8714 edges, or interactions in a directed graph format. 

Structure Of The Network: "The Great Retweet" 
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( https://017qnd p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen3. png) 

This network operates in a structured manner to ensure brand new accounts with zero followers and zero 
accounts following are able to post one tweet and have that tweet magnified with, on average, between 
200 and 1000 likes and retweets. 

This can be seen in the image above. The red boxes included are clusters that operate within this network 
to post and amplify the campaign's agenda. 

This is a sustainable and effective model for the network — when it suffers account closures and mass 
deletions, it can simply create new accounts to re-support that model. 

To carry out that task, the network consists of two limbs: posters and amplifiers. Each has their function 
in the chain of operations. This can be seen in the image below, which shows central accounts that would 
have posted content, and the surrounding accounts that retweeted it. 
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( https://017qnd p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen4. png) 

First, I will use the example of account mutoresmitak. It operates as a poster. It has 10 people following, 
and 4 followers. 
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( https://017qnd p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen5. pna) 
Below is an example of a tweet it posted that is critical of Guo Wengui. 
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Pinned Tweet 

@mutorcsmitak - May 3 

Not surprisingly, MilesGuo's current home of G coins and 
GFASHION must be another farce. 
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( https://017qnd D vnh-flvwheel.netdna-ssl.com/wp-content/uDloads/2020/05/wen6. Dna) 
The likes and retweets are unnaturally high for an account of this nature. 


However, it is not the only account posting content like this. Many other accounts with very few followers 
— yet with exceptionally high retweet and like ratios — are posting this content. 
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( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen7. pna) 

In the data visualisation, we can see mutoresmitak's amplifier network, with the accounts surrounding 
mutoresmitak, seen below. 
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( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen8. Dna) 

The network accounts surrounding mutoresmitak are the amplifiers of mutoresmitak's content, as well as 
other poster accounts that require amplification. 

This smaller cluster of poster and amplifier accounts, like mutoresmitak's cluster, is repeated across the 
entire network, drawing resources from many other accounts. You can see this in the image below, which 
shows stronger edges (the lines) forming the links between clusters in the network. 
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( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen9. Dna) 

Creation Of New Accounts To Fuel The Network 

The network supports its operations by creating new accounts every day. Over the time the dataset was 
collected, many new accounts were created to join the network. 

Over the space of four days, the following numbers joined the network: 

• April 27, 2020: 52 accounts 

• April 28, 2020: 97 accounts 

• April 29, 2020:109 accounts 

• April 30, 2020:151 accounts 

I have provided screenshots below of samples from those dates to show the accounts created, their 
generic Twitter handles, and usernames. 
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©bemard752&5652 

<[202O-Q4-3QT14:15:46.1 £GZ, 24 

Thu Apt 30 15:07:45 EST 2020 

Bernardo 


19 

1 

3julian341Gl970 

©julianB4151970 

<[202O-Q4-3DT16:39:06.9802, 24 

Thu Apr 30 15:07:45 EST 2020 

Julian 


10 

0 

SandreS 1230461 

©andreB 1230461 

<[2020-04-30^14:16:01.974Z, 24 

Thu Apt 30 15:07:47 EST 2020 

Andre 


16 

2 

■3 id xlsStvOnioj x 

fficlxIaSfvflnioix 

<[202O-Q4-3DT14:47:58.091 Z]> 

Thu Apt 30 15:26:29 EST 2020 

Knapa 


1 

0 

30d7ubya2yao3wee 

©0d7 ubya2yao3we€i 

<J20£O-O4-3OT14:57:12.990Z]> 

Thu Apt 30 15:34:40 EST 2020 

79561404537 


4 

0 

Sforbeilnnichial 

©forbertiTiichial 

<PC20-IM-30T15:41 :Q3.633Z> 

Thu Apt 30 15:36:07 EST 2020 

Michial Forbert 


0 

0 

3ihiuypuigfr&4xkz 

■SihiuypugfrS-lxkz 

<J202O-O4-3OT14:4055.550Z, 24 

Thu Apt 30 15:33:03 EST 2020 

iHapnca 


1 

0 

&zmlgovlr7negdnj 

@zm 1 govl r7ragd n j 

<[202D-04-3DT14:57:14.931 Z]> 

Thu Apt 30 15:43:33 EST 2020 

79672074261 


2 

0 

36fg645jtxvm2blb 

«6fg645jtxvm2blb 

<L202O-D4-3OT14:52:33.3G7Z]> 

Thu Apt 30 15:50:54 EST 2020 

aapaaM 


0 

0 

Sceuqdyiekcelplu 

©c BLtqd y ia kca 1 p h r 

<[202O-04-3DT15:05:19.79BZ, 24 

Thu Apt 30 15:59:54 EST 2020 

crerfjBH 


1 

1 

3dlt1 uSBbgqaOqxc 

©dltl uESbgqeQqxc 

<p02O-04-3OT15:30^17.453Z]> 

Thu Apt 30 16:03:06 EST 2020 

£[bhb 


2 

0 

■S'oSgijf nn h j wiedib 

SQOgufrmhjwicdib 

<[2020-05-01T10:51:55.591 Z]> 

Thu Apt 30 16:11:2B EST 2020 

ApwHa 


191 

0 

■3ndsBa23ckjr0qr5c 

©ndE.aa23dqr9qr&G 

<[2020-05-01T10:52^3.74SZ]> 

Thu Apt 30 17:09:04 EST 2020 

79774276225 


179 

1 

S'xdetkki wxbl d pnf 

©xdetkkiwxb 1 dpnf 

<[2020-05-01 T09^3^3.B8OZ]> 

Thu Apt 30 17:14:03 EST 2020 

79773932831 


31 

0 

3csm5nedibvinpgq 

©■csmSnedibvinpgq 

<[2020-05-01 T09:23:21 .B05Z]> 

Thu Apt 30 17:16:24 EST 2020 

77761542907 


26 

2 

31 Iu2w9ayywelwxr 

©1 tu2w9ayywelwxr 

<[2020-05-01 T09^2:13.47SZ, 24 

Thu Apt 30 17:1 3:3B EST 2020 

79640130427 


34 

0 

3 pn kei2jhmujomfti 

©pnkei2jhrrvvjQmfh 

<[2020-05-01 T09^3^7.9£5Z]> 

Thu Apt 30 17:22:46 EST 2020 

79640137599 


30 

0 

3zyqqo6ilii4djso7 

©zyqqoGi ln4djao7 

<12020-05-01™^3^1.773Z]> 

Thu Apt 30 17:26:34 EST 2020 

79640144252 


30 

0 

Sdl&ncyl m2njwso8 

©dlsnoyl rn2fijwE.oE 

<[2020-05-01 T109^2:17.3G4Z]> 

Thu Apt 30 17:23:03 EST 2020 

79640140571 


170 

1 

3wlad6B3731G3 

■Swlad 533731 03 

<[2020-05-01T12:44:1 £.387Z]> 

Thu Apt 30 13:29:16 EST 2020 

wlad 


37 

1 

Shabermehll 4 

©hahermehl14 

<[2020-05-01T10:52:DS.5£BZ]> 

Thu Apt 30 13:53:53 EST 2020 

Habermehl 


121 

0 

®mutter46G0203S 

©murttarJ&G02035 

<[2020-05-01T10:52:04.B02Z]> 

Thu Apt 30 13:54:1 B EST 2020 

Mutter 


126 

0 

Swo-odbecklB 

©wocdbeckl B 

<[2020-05-01T10:51:55.492Z]> 

Thu Apt 30 19:01:36 EST 2020 

vVood beck 


140 

0 

3xc kewi ugp3ze 130 

©xckewiugpSzel B0 

<[2020-05-01T10:51:49.5G0Z]:-> 

Thu Apt 30 19:19:01 EST 2020 

793211GBG34 


176 

0 

SutmklygBeaeqfgr 

©ulmklygBea&qfgr 

<[2020-05-01T10:52:38.39OZ]> 

Thu Apt 30 19:23:26 EST 2020 

7932790BG24 


173 

0 

S9iqqxnzqxwirioytk 

©9iqqxnzqxwm[?ytk 

<[2020-05-01T10:52:29.071 Z]> 

Thu Apt 30 19:25:05 EST 2020 

79327907475 


175 

0 

3lxt4Ggch.zdjariu 

i i 5. t -16 g c h zd j a ri J 

<[2020-05-01T10:52:01 .GG3Z]> 

Thu Apt 30 19:25:1 6 EST 2020 

79327909046 


176 

0 

3-emfw4hh4bjye9xp 

©emfw4foh4bjye9xp 

<[2020-05-01T10:52^3.981 Z]> 

Thu Apt 30 19:27:19 EST 2020 

79327906G55 


171 

0 

3 7fdel i 1 jGd kzz5m 

©7fdeli1jGdkzzGm 

<[2020-05-01 T09:21^5.1 A OZ. 24 

: Thu Apt 30 19:29:43 EST 2020 

793211G6547 


174 

0 

3 no pkd urnrn skloqoz 

©nopkdummskkK|az 

<[2020-05-01T10:51:57.534Z]> 

Thu Apt 30 19:33:56 EST 2020 

Kona6 


166 

0 

3wbejvtwavuukkqa 

©wbejvtwavuukkqa 

<[2020-05-0170937:37.1 £6Z]> 

Thu Apt 30 19:44:27 EST 2020 

79327907334 


131 

0 

3'pygxhusfts3wyzj 

©pyg a h u sfts-3 wyzj 

<[2020-05-01106:37:34.68 7Z]> 

Thu Apt 30 19:44:36 EST 2020 

£[MHTpi1KI 


139 

0 

3npoporina 

©npoparina 

<[2020-05-02T06:39:30.304Z 1 24 

: Thu Apt 30 20:19:22 EST 2020 

IMataliya Paporina 


47 

1 

SzjuoOjinvwqSupinx 

©■zj uoOj mvwqSupmx 

<[202O-05-02T09:D2:D8.4£4Z. 24 

: Thu Apt 30 21:05:20 EST 2020 

SqapoBa SangHiti 


£02 

1 

39focf nom rfvjpnv 

©9focfnpomrfujpnv 

<[2020-05-01T10:52:1 Q.07BZ]> 

Thu Apt 30 21:07:09 EST 2020 

79327907569 


16 

0 

3d&gfO02M722 

®dsgfQ6£09722 

<[2020-05-01 T09:37:34.511 Z]> 

Thu Apt 30 21:29:3& EST 2020 

dsgf 


177 

0 

3d'5gdfg370311&2 

©dsgdfg37G31152 

<[2020-05-01 T09:37:38.GG2Z]> 

Thu Apt 30 22:11:16 EST 2020 

dsgdfg 


175 

0 

3lanaaa999 

©lanaaaBSS 

<[2020-05-01T10:52:D7.643Z]> 

Thu Apt 30 22:19:23 EST 2020 

TlaHa EpoqcKan 


130 

0 

3aG3wv3crhg5plaa 

©aQ3wv3crhg5plaa 

<[2020-05-01T1232:083G5Z]> 

Thu Apt 30 22:20:20 EST 2020 

tana 


61 

0 

3 coll ins unity 

©collins unity 

<[202O-05-02T06:42:18.70SZ, 24 

: Thu Apt 30 22:41:13 EST 2020 

Unity Collins 


£11 

0 

3butlerquintina 

©butletquintina 

<[202O-05-03T09:Q7:57.31 DZ]> 

Thu Apt 30 22:51:42 EST 2020 

□uintina Butler 


277 

1 

S , xcwazwtaGp9f3yj 

©KcwozwtaGp9f8yj 

<[2020-05-01T10:51:57_637Z]> 

Thu Apt 30 22:56:46 EST 2020 

793211G6547 


130 

0 

®hse4w7j i2h 170zn 

©hae4w7ji2h17Qzn 

<[2020-05-01 T09:36:5£.377Z]> 

Thu Apt 30 22:59:1 7 EST 2020 

793211GB549 


132 

0 

3 r vpt2ytiuqgstfr1 

©vpt2ytiuqgstfri 

<[2020-05-01 T09:36:54.3£4Z]> 

Thu Apt 30 23:00:52 EST 2020 

79327909137 


179 

0 

3n8zrzgehpnx3nx0 

©n3zrzgehpnx3nxQ 

<[2020-05-01 T09:37:38.GG2Z]> 

Thu Apt 30 23:01:53 EST 2020 

79327907334 


176 

0 

■3 m knqn8daeg Use 

■3 mkr qnStlaeg Use 

<[2020-05-01 T09:36:54.397Z]> 

Thu Apt 30 23:03:53 EST 2020 

79327906596 


130 

0 

3bl9Q2p6do8yzcfx 

■3-51502 p6do8yzcfx 

<[2020-05-01 T09:37:38.663Z]> 

Thu Apt 30 23:05:1 D EST 2020 

79327909036 


176 

0 

®pBt&rmo467458S4 

©petarmo4G745B54 

<[2020-05-01T10:51:53.51 DZ]> 

Thu Apt 30 23:20:45 EST 2020 

Pater Moody 


173 

0 

3allenwyomia 

©alien wyomia 

<[2020-05-01T10:51:51.490Z]> 

Thu Apt 30 23:26:1 0 EST 2020 

i/VyDmia Allen 


131 

0 

3'odattah&5479714 

©ndettah55479714 

<[2020-05-01T10:52:DS.57BZ]> 

Thu Apt 30 23:30:00 EST 2020 

Odette Henderson 


134 

0 

3-pO 3611130 

-3-pOBG111 30 

<[2020-05-01T10:51 :G9.G03Z]> 

Thu Apt 30 23:33:35 EST 2020 

Ramona Peterson 


133 

1 


( https://017qnd p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen10-date3Q. pna) 
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Not only are the mass creation dates and times visible in this, but also the nature of the accounts' names, 
of which many appear in cyrillic, yet support a pro-Chinese government narrative. 


Language Themes Of The Network's Accounts 

The accounts providing the amplification vary in languages and the style of names Twitter, and when 
there is a bio present, they vary in that too. 

Some accounts use names written in Chinese, while other accounts in the network use Russian Twitter 
account names written in Cyrillic alphabet. 

For example, let's look at account FFJdream, one of the posters of the more common media seen 
displayed under the MilesGuo hashtags. 


/ 



erdem gunsel 

@FFJdream 


#MilesGuo can betray comrades for money! His friends 
saw his scam! His friend countered him.#f|?^tS 














ft 


wk ha. stt ii6Bg=tt*ffiRtf* 

^huha, iHKsaattjiis, as. 

SSfSMSSigfflftiS, tSSB&$tlf^AST*a:e, KW«SdJ^, 

H, jEK& 7—m. 

S^JrfBa. »SS5!»-7-SisA±aWt», S£Wjifc7fSeei£». ATKI'tSKOWL 5®HBip*fcl**4£g, 
fkommwj:, sss:*ji^ssiiA±fl9«^-^ii£t*flsi. fg®sg)taiSBa5»i45^. ffiSftw&SKWittr: 

ftft§saura&ff. 

ih^±, s*, xm^m^sm^iVA^mm, mxm 

4SfQg5SA±fll&, afiMA@teSA'SfiE7*£S, ffi&* mm, MIMS. SiiA±i«te*ifl, RHI@*;i. mSL 

MMim. max, mmttim&m, 

am. s*ffissi7&. sirum*, imsHMHMiUJW*, * 

aaaram. SOTfiUfifiBfli. mum*. ttjR£SBW:2:B-#, *>jmvxi$#mnm® 

mtmmm& f^an^MKRaiimAws. HaRManHMSwtKr&ft. Ji#ii£fB*!®?'j 'Me 
SB, <§74S^7AiMA7!£Ai??lf P , ftiMfiEtt. WSSSP*®X^HISSfil'if®W 

ffcdK31A±Klg#jlR^llfr _ 

- 5cittaw^ii'2'^^#§jdffKAW!. 

smaje. *wi«»iEi»+*K*is«sA. ««ti®»**i7&. mmmmsm^mmmBfSL, ;mm&, gtv. . *« 

immamem-ism. , ^ttaitssrtgsijs, 

mtto. &BXf£BttMJE. KS&WmSB^WXBa&fHS. gm^ffiSisA 

itEBcSPitt, WAWxmifoW&^&KWffi,, max, S7gaimim*jk, %xm>wmB 

gis^05K®A±asffiBsusT, , &fte»ffW3iWi?«. 

Ba^sflasBSBi^^js, smibaptwsii, max, fft#^iftst*ih^^«»!«suii^i£#tay?, ism 

Si^Sfif#B5ftfiif#S44S^aS#i[Sl^HS. HigrES^ttvIA. BSt&ffiJUffiSW, ^aTHEt^AffiSfU, ®5#@iI£«ie<iifc®r]iSiii3fc‘8i£ 


4:16 AM • May 1, 2020 • Twitter for iPhone IMG0- 


86 Retweets 45 Likes 


( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen11. pna) 

The retweets appear to come from a mix of different accounts, but for the majority, they display in 
Cyrillic-based languages, primarily in Russian. 
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X Retweeted by 




wxm j 

^hRSHMt&R, SE 
£h*j£, 

JafQRiiA±fi}(&, 3JSE 

wwui, mx, hjbb$ 

®&WX: 

mssm. \ 
'mtmsmm®. ra&i 
mm, 

MmsTOKHu, ttjtti 
HTO&. **$£1 

^o(6)^ 0 

±»tg«]itt. i0&f|S&ft( 
gS8l&a«i5A±S*«J 

*i?Ka^K)«TiJW»4^i 

wwm&9mi3WBto& 


© 

o 


mourad hani 

@mouradhani9 


B/iaflMMnp 

@3xmHa5cA4pVa4VK 



✓ 


4:16 AM-May 1 


Hara/ibn 

@VQQcKrJLcAfsKWj 

>KM3HM pafla 

^ Edik matuzkov 

@EMatuzkov 


86 Retweets 

Q 

AJ-g, Katie C 

JVpy Replyin 

Friends 

Q i 


o 


BlIMfl 

@DA6tMZ4zjCmsYBS 



Johny Ochoa Correa 

@JohnyOC2 


O 


Ammtpmm 

@Rk5MrvZPgeOnlb3 


^ Follow ^ 
^ Follow ^ 
^ Follow ^ 


Follow ^ 
Follow ^ 
^ Follow ^ 
Follow ^ 



erdem 

^ Gtv is l 

Q 



.-i 


klBaH 

L @npPr9BvvE2Pm9p3 


i/ H : A 


^ Follow ^ 


( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen12. pna) 


/ 







X Retweeted by 



i-reeiancer, student 




9\na 

@VJakWC3UpeWxKQU 

J1k)6/iio Kyujou, 


Follow ^ 


*~i a Mapmna 

@ y bgZ1kKRZmopZkl 


Follow ^ 




< i 


Ah B3anMO noflnMCKa B3anMonoflnncKa 

@ZH1881 


^ Follow ^ 


•rM risen 


:16 AM • May 1 


(^B3anMonoAni/iCKa, Mory He cpa3y 3aMeTMTb@ ho 100% Hmaio 
B3aMMHO© llpocTO ecTb Ta«i/ie Tuna noflrmca/icfl m noTOM OTnHca/ica 
Tuna a aToro He 3aMeny! 3aMeny@. M yfla/iaio 


86 Retweets 


A 


>KyKC 

@TFDtR8ts09xdVVS 


Follow ^ 


Q 


e 


Katie C 


- 

1 Replyin 

Friends * 3 * 


Dmarc91 

@Dmarc911 


^ Follow ^ 


Q i 


manna 

@marina79837906 

me gusta trabajar y soy responsable 


Follow ^ 



erdem 

Gtv is l 




Q 


Stilianos Kanakidis 

@stilian_kanak 

flDOCTO Mv>KHHHa b ronax-CTapm<. 


^ Follow ^ 


( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen13. pna) 

It is evident by looking at the data in spreadsheet format that there is a tendency to use Russian names. 
Below are some of the screenshots from the days that saw significant account creations. The names 
column is identified in red. 
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216 

217 

218 

219 


@beverleybornt12 

@bevedeybornt12 

<(2020-05-01T15:19:39.343Z]> 

Fri May 01 16:15:32 BST 2020 

beverley borntraeger 


0 

0 


@yky7wcar3dsfm5m 

@yky7wcar3dsfm5m 

<(2020-05-02T09:01:52.390Z, 2(7 

Fri May 01 16:36:27 BST 2020 

flaw a 


159 

0 


@fer66752192 

@xinluben 

@fer66752192 

<[2020-05-02T06:40:54.076Z, 20 

Fri May 01 16:57:38 BST 2020 

fer 


5 

1 


©xinluben 

<(2020-05-02T06:21:28.896Z. 20 

Fri May 01 17:00:43 BST 2020 



1 

0 

220 

221 

222 

223 

224 

225 

226 

227 

228 

229 

©sirenaschulzjlO 

©henry rgan 

©sheelasohail 

©dymiOgehfxhberd 

©sirenaschulzjlO 

<(2020-05-01T16:57:53.801 Z)> 

Fri May 01 17:39:45 BST 2020 

sirena Schulz-joergensen do V. v 

ietersheim 

0 

0 


©henryrgan 

<(2020-05-02T06:20:41.130Z, 2(7 

Fri May 01 17:42:07 BST 2020 

Morgan Henry 


61 

0 


©sheelasohail 

<(2020-05-01 T16:53:57.637Z)> 

Fri May 01 17:44:33 BST 2020 

sheela sohail 


8 

0 


©dymiOgehfxhberd 

<(2020-05-02T09:00:53.978Z. 20 

Fri May 01 17:49:54 BST 2020 

AHioTa 


95 

0 


©paultpwong 

©paultpwong 

<(2020-04-29T19:31:19.730Z]> 

Fri May 01 17:56:31 BST 2009 

Dr. Paul T. P. Wong 

Toronto 

6890 

6330 

Clinical Psychologist, 

@coriner64553397 

@hughbeasley4 

0coriner64553397 

<(2020-05-01T17:18:34.557Z)> 

Fri May 01 17:59:06 BST 2020 

corine rodriguez 


0 

0 


@hughbeasley4 

<(2020-05-03T09:03:17.714Z)> 

Fri May 01 18:15:23 BST 2020 

Hugh Beasley 


160 

1 


©ferdinanddickeS 

©wowa48139408 

@ferdinanddicke5 

<(2020-05-03T09:04:05.885Z]> 

Fri May 01 18:16:38 BST 2020 

Ferdinand Dickerson 


195 

1 


@wowa48139408 

<(2020-05-02T11:43:59.936Z]> 

Fri May 01 18:20:37 BST 2020 

wowa 


45 

0 

@xdpmxiir>euuweo3 

@xdpmxiineuuweo3 

<(2020-05-02T09:01:52.346Z. 20 

Fri May 01 18:29:26 BST 2020 

AnnHa 


161 

0 


230 

231 

232 

233 

234 

235 

236 

237 

238 

239 

240 

@v5lp708ot71b55s 

©sff79761443 

@v5lp708ot71b55s 

<(2020-05-02T09:01:56.342Z. 2(7 

Fri May 01 18:34:11 BST 2020 

MuHa 


152 

0 


0sff79761443 

<(2020-05-02T06:42:08.874Z, 20“ 

Fri May 01 19:01:15 BST 2020 

sff 


129 

0 


©sgfr36390076 

@karbone32 

@sgfr36390076 

<(2020-05-02T06:39:35.670Z. 20 

Fri May 01 19:08:47 BST 2020 

sgfr 


117 

0 


@karbone32 

<(2020-05-02T06:42:16.657Z. 20 

Fri May 01 19:28:33 BST 2020 

karbone32 


15 

0 


@cvgacfpla18nm1g 

@gexam88108068 

@cvgacfpla18nm1g 

<(2020-05-02T09:03:43.042Z, 20 

Fri May 01 19:31:04 BST 2020 

EneHa 


165 

0 


@gexam88108068 

<(2020-05-02T08:59:30.726Z)> 

Fri May 01 19:35:07 BST 2020 

Gexam 


90 

0 


@9zbjtwc0qdyu8np 

@9zbjtwc0qdyu8np 

<(2020-05-02T09:02:14.929Z. 20 

Fri May 01 19:45:57 BST 2020 

O/ifl 


132 

0 


@t1 ccfupcwSmjrhq 

@t1ccfupcw5mjrhq 

<(2020-05-02T09:02:05.966Z. 20! 

Fri May 01 19:58:16 BST 2020 

Caera 


217 

0 


©huioki432 

0huioki432 

<(2020-05-02T06:40:52.177Z, 20! 

Fri May 01 20:04:41 BST 2020 

huioki432 


23 

1 


©Iarisabaeva7 

©barsexl5 

@larisabaeva7 

<(2020-05-02T08:05:03.306ZJ> 

Fri May 01 20:05:04 BST 2020 

Jlapuca 

<M8B 

5 

0 

Ao6pan. 3aM6MaTenb 

©barsexl 5 

<(2020-05-02T09:24:12.673Z)> 

Fri May 01 20:08:05 BST 2020 

Barsex 


64 

0 


241 

242 

243 

i 244 

245 

246 

247 

248 

249 

250 

@wccghll3nvsll3 

0wccghll3nvsll3 

<[2020-05-02T09:02:08.430Z, 2(7 

Fri May 01 20:08:55 BST 2020 

Hropa 


217 

0 


@leonidsergeevi8 

@leonidsergeevi8 

<(2020-05-02T09:32:47.853Z, 2(7 

Fri May 01 20:15:46 BST 2020 

Leonid Sergeevich 


121 

0 


@an3keegjtljp1tx 

0an3keegjtljp1tx 

<(2020-05-02T09:01:54.408Z. 2(7 

Fri May 01 20:20:40 BST 2020 

flapbn 3no6nHa 


126 

0 


@bjg3ycauqejkdzf 

@ivoninaaa999 

@bjg3ycauqejkdzf 

<(2020-05-02T09:01:50.402Z. 20: 

Fri May 01 20:27:20 BST 2020 

flap bn 


206 

1 


@ivoninaaa999 

<[2020-05-02T09:01:12.000Z, 2C7 

Fri May 01 20:36:07 BST 2020 

/lepa Hbohhh3 


98 

1 

hoe hoe 

«fvk9rqmznwq60n3 

@alinaaa99999 

0fvk9rqmznwq6On3 

<(2020-05-02T06:42:16.659ZJ> 

Fri May 01 20:46:58 BST 2020 

Enewa 


110 

0 


@alinaaa99999 

<(2020-05-02T06:41:38.461 Z. 2(7 

Fri May 01 20:50:21 BST 2020 
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©elisejo88933763 

©elise(o88933763 

<[2020-05-04T07:54:55.395Z)> 

Sun May 03 20:01:50 BST 2020 

Elise Joyce 


116 

0 

Hello this is my bio 

©michell59738804 

@michell59738804 

<[2020-05-04T06:28:17.616Z, 20: 

Sun May 03 20:04:57 BST 2020 

Michelle Campbell 


121 

0 


©ceryshussain 

©ceryshussain 

<[2020-05-04T08:20:37.592Z]> 

Sun May 03 20:09:02 BST 2020 

Cerys Hussain 


119 

0 

Hello this is my bio 

©eringoo68791239 

Oeringoo68791239 

<[2020-05-04T08:20:39.670Z)> 

Sun May 03 20:18:31 BST 2020 

Erin Goodwin 


116 

0 

What's up brother this is my bio 

©dorisle51591089 

©dorisle51591089 

<[2020-05-03T19:26:42.029Z]> 

Sun May 03 20:20:23 BST 2020 

dons lewis 


0 

0 


©Iirvdaga31531118 

©Iindaga31531118 

<[2020-05-04T07:54:47.357Z. 20i 

Sun May 03 20:24:17 BST 2020 

Linda Garcia 


126 

0 


©Iindaga60187974 

©Iindaga60187974 

<[2020-05-04T07:55:15.805Z]> 

Sun May 03 20:29:18 BST 2020 

Linda Garcia 


124 

0 


©kimbert34943397 

©kimberl34943397 

<[2020-05-04T07:55:15.729Z]> 

Sun May 03 20:32:13 BST 2020 

Kimberiy Davis 


128 

0 


©2nfsh4itgc6ichr 

92nfsh4itgc6ichr 

<[2020-05-04T07:50:43.969Z]> 

Sun May 03 20:39:01 BST 2020 

KpMCTMHa 


125 

0 


©mairalo35761583 

9mairalo35761583 

< [2020-05-03T20:15:18.618Z]> 

Sun May 03 20:45:06 BST 2020 

maira lopez 


0 

0 

14 anos, taurino. corinthiano fantico.. O resto fica por sua conta ;) 

6fytdiyqu5idmhbx 

@fytdiyqu5idmhbx 

<[2020-05-04T07:55:05.426Z]> 

Sun May 03 20:53:14 BST 2020 

EareHMfl 


126 

0 


©hsor4qjqw9aierj 

Ohsor4qjqw9aierj 

<[2020-05-04T07:55:07.576Z)> 

Sun May 03 20:56:48 BST 2020 

Ma<pno3HHK 


126 

0 


@earbzbi9k5zzdqn 

@earbzbi9k5zzdqn 

<[2020-05-04T07:55:13.542Z)> 

Sun May 03 20:57:34 BST 2020 

Anec» 


127 

0 


©uilidh9dr8hbd31 

®ullidh9dr8hbd31 

<[2020-05-04T06:27:35.426Z)> 

Sun May 03 21:00:02 BST 2020 

Hrnca 


120 

0 



( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen16. Dna) 

Content Of The Network: The Case Of Guo Wengui 

Many of the accounts are part of a sustained information campaign against Guo Wengui, an exiled 
Chinese businessman residing in the United States. 

This is not the first time Wengui, also known as Miles Kwok, has been subject to a coordinated campaign 
on Twitter. A report from ASPI in 2019 (https://www.aspi.or a .au/report/tweetin a -throu ah-a reat-firewall ) 
identified operations targeting him as far back as April 2017. 


Wengui has been critical of the Chinese government in the past, and more recently he has criticised its 
response to COVID-19. Many of the accounts in the network target these claims specifically. 


/ 























This analysis does not support claims made by Wengui, nor does it negate them. The focus of this report 
is on the network, not Wengui. 

Common points of the network are the previously mentioned poster and amplifier system, as well as the 
posts, which consist of graphics and text written in Chinese. 

The text is critical of Wengui and his claims and appears to counter some of the claims he makes. 

These posts are echoed largely in the network, as seen below 






•MJc-S&UO Guo WtonguM has b«n cwnij Hill- to rveH mm*? 

co btrp sIwh in GNEW5- on 1 .-rcc-mty, to Ht i --11 no anc- K 
IVkJtd. «1 Ihir ptfSl trMl diyi. hi lu'ftW CO lH JZOn GFA&H CH -Hid G (Wifi 


ijtt!FechflvuteVflkn y»vi 

' in iq- r#K S coin. MiasQuo cm drslfced 

Rpc (bepfc'i vrCuH evretrKr. «n Mil**Ckn> Oratftoft Iwf? 


A W*ECl 

A 


eJTSf l>j-. Fffn>Ju« wilJc- mHfllHfMlf] 4 U+, w t pI* 

irtuiuputout i li la'^D mwwy Hd poods, inanHteH ruiuM, Mi quo 
i- Itrt GAyl til iiVm-e iU lifei-r HHiLIiOii 


(iqiiliqpiquo Apr 24 

■Gu*W#ftaui'fi bnifiwnfimg reiWvflt&d, d* you ic!w 


-p 1=1 , 

IBIS SBStJHSp«3PE7fiftfi*fl>iiE 


IMS? 


I : ' Guo WtfiQuihH b4tn ceding hice inrnon*F 

lp ih»'P’ H CiMEwS t>TV rp-rnullJ-. Iij m ful mj -ijt* i* (H"»i 

looted, hi Ihe Im dHji, he- turned «■ bruewi C3RA5HION Hid G com? 


cJ4K3H<]MlZniV2JI Apr 27 

"v H □' V is- |Lst -1 Inck of Mitasfiiio's scair Mi’esCFuD's GTV will 
avarflujlk 1 become another .ok*. 


GTV. Mins CuO i l*liud 'M.YAibl GuO iiptiMd hit 'H:0 for 


*' a -* 
28 ;; £) 


FMM !l^flabwd8250 Apr 2& 

#K£f All oi h« CBOsequeoces h* UHbci tor NmieH. let the MBd hyIj. 

ill** llni- b-lHVtf! 


( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen7. pna) 

The content is also present on Facebook, where the network also operates using hijacked accounts and 
pages. 
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All Uddin 

April 22 at 4:07 AM -0 


Guo Wengui has reached the end of the mountains and waters, 
and the end will surely come.#MilesGuo 


s«5(E04}«ai* 

sea, AeiA -a*'*******!***#**?. 

♦*+A*«4 CTVfi*ti*. ***-**#**#*, + 

ft#**********#. SB. £**»£*£ **a*A, & 

***** **£**,6*. a********, 
s*#****.*, *+a« *#*(■***. 

UrtiTl+yf. 

(Mr**. ***# 

*S»5»T4«. WffiSiS, v-*"*"*!*, ***«»**, Til* 
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iQ 38 18 Comments 24 Shares 



( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen17. pnq) 
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Goodtech 

April 28 at 7:01 AM ■ 0 


#MilesGuo It's just that fantasy is a fantasy after all, Guo Wengui sinking 
Into it.#MilesGuo 



r.x******! "crv JEtfciWR.i**;******. 

fc******^®*?^#FBI. K*»teSSF£**£, K 

D^*id£ifeir£«, -*«*»*# 
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17 Comments 24 Shares 


( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen18. png) 
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Goodtech 

April 30 at 6:55 AM * 0 


#?PXS MilesGuo bragging, the ultimate purpose is for money.#|[?$: 


n£££$n 






is, Slit’SI bM. - 

-4-* 
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© 40 
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15 Comments 25 Shares 


( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen19. pna) 












Mohhmad Jewel Ahmed 

April 30 at 6:57 AM • $ 


#1 PXff MilesGuo can only accept justice.#?^^ 


GTV 
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14 Comments 23 Shares 


( https://017qnd p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen2Q. pna) 

Content Of The Network: Alternative Topics 

The network on Twitter does not just amplify content based on Wengui. It also appears to target other 
areas in coordinated efforts, for example the Hong Kong protests, cryptocurrency, and COVID-19. 

Hong Kong Protests Content 

The same network amplifying content related to Wengui is also critical of the Hong Kong protest 
movement. These findings are consistent with the 2019 report made by ASPI 

( https://www.aspi.or a .au/report/tweetin a -throu ah-g reat-firewall ) as well as the targeting of political 
opponents and protestors. 

In the network, a number of amplifier Russian-themed accounts have been identified. By looking at the 
activity of those accounts we can identify the links to potential efforts of the network. 

Below is an amplifier account active in that network. 



















^ooo^i ( Follow , 


HaTanbfl 

@VQQcKrJLcAfsKWj 

>KM3HM pafla 

W\ Joined February 2020 
1,001 Following 9 Followers 
Not followed by anyone you're following 


( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/Q5/wen21. pna) 

It retweets content consistent with the efforts of the network — as seen below, there are tweets about 
Wengui and tweets on Elon Musk and cryptocurrency (these will be shown as part of the network's 
targeting in the next section). 








H Haia/ibfl Retweeted 

Shannon Cox @Shannon18115401 • May 2 
^ P #|^M Guo Wengui tried every means to cheat money, but no one 
would believe his lies.#|P^m 
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( https://017qnd p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen22. png) 













'Ll HaTa/ibfl Retweeted 

Kruti Harris @KrutiHarris1 • May 2 

Guo Wengui has become an anchor with goods. Is his idea too 
naive or his IQ too low?#|^M 
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( https://017and p vnh-flvwheel.netdna-ssl.com/wp-content/uploads/2020/05/wen23. png) 










'Ll Haia/ibfl Retweeted 

’ - 1 h Jeff Tiedrich (§>Thomas_Leca • May 1 v 

fi ^15 # 

r r *■£’ > Replying to @JeffreyGuterman @realDonaldTrump and @FBI 
Amazing! 


r <- Tweet 

Elon Musk ® 

@elonmusk 

We here at Tesla have decided to throw a crypto party 
of sorts — we are giving away Bitcoins! Wanna get 
some — go to; www.elongivesbtc.com 
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The same account reposted this tweet supportive of China's actions in the Hong Kong protests. 
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@HaroldCiresi14 * May 2 

#5— The Hong Kong issue is China's internal affairs and cannot 
be interfered with.#^;# #£— 
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The network amplifies a series of tweets supportive of the police in Hong Kong and critical of those who 
seek independence. Screenshots of some of the posts in the network by other Russian or Chinese-named 
amplifiers are as follows. 














O O/ibra Retweeted 

Stephanie Ali @Stephan51506816 * May 2 

#ff #£— Supporting the Hong Kong police to stop violence has 
become the common idea of Hong Kong citizens.#fi;|| #£— 
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±imm @FranckLESCUT • Apr 29 v 

##;# People who disrupt the rule of law in Hong Kong will not have good 
results.##/# 
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cyi @WendyHa36319874 • May 3 \ 

#WM #£— The law enforcement of the Hong Kong police is too gentle, 
and the scoundrels are like grasshoppers who can't lie for a few days 
after autumn!#5— 
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Cryptocurrency/Elon Musk Content 

Another example of the content retweeted by this network is evidenced below. It is content related to 
Elon Musk and cryptocurrency. 

The graphic below represents retweeters of one of the Wengui posts on the left and those same accounts 
retweeting the Elon Musk crypto post. I have matched them to all retweeting the same Elon 
Musk/crypto-related post that was a comment underneath a post from Donald Trump. 
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COVID-19 Content 

That same cluster seen above has also amplified specific posts on COVID-19, targeting the U.S. These 
accounts posting the content follow the same structure of name, account creation, and targeted 
campaign areas. 

The posts seen include subject matter of health posts on links between vaping and COVID-19 and 
allegations of biosecurity incidents in the U.S. with the tags #coronavirus and #TruthAboutCovid. 
Examples can be seen below, these are screenshots from two of the same accounts that were seen above 
(Johny Ochoa Correa, HaTanba). 









Ti Johny Ochoa Correa Retweeted 

BceBO/iOA npeMC @VsevolodPr • Apr 27 

Is There Actually a Link Between Vaping and COVID-19? 




#EVALI #VAPI #Covid 19 #Covid #Coronavirustruth 



The Truth of Coronavirus is Coming! - HeadlinePlus Press Release D... 

The US government panicked! UN Secretary General Guterres said on 
April 8 that after the end of the novel coronavirus pneumonia ... 
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Again, the retweets of the above post follow the same signs present among amplifiers in the network. 
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11 Amutpmm Retweeted 

^ BceBonoA npeftc @VsevolodPr • Apr 30 v 

I The virus "variola" was fend in NIH Bethesda campus! 

We believe that there are more biosecurity incidents in the United States 
that have not been revealed! 


#coronavirus #Covid 19 #COVID 19 #TruthAboutCovid 
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And below are the retweets of the post above. 
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Summary Of Findings 





























This analysis shows that there is an active network of accounts targeting subjects in a coordinated 
approach to skew the narrative around varying topics, and to push set agendas. Many of these agendas 
are supportive of the Chinese government and critical of either popular figures or protestors who are 
against it. 

The network operates through consistent account creation to add more numbers and seeming veracity to 
its network, using a system of poster and amplifier accounts to "stage" trending topics, and to provide the 
illusion of viral tweets. 

This network exists on both Twitter and Facebook. 

Content of the accounts correlates with findings made in the past, both by Twitter and other entities, of 
state-linked information operations that are being run out of People's Republic of China. 
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( https://www.bellin q cat.com/author/ben i aminstrick/ ) 

Benjamin Strick is an open source investigator for the BBC 
and an analyst in geospatial intelligence, mapping and 
networks. He has a background in law and the military, and 
focusses on using OSINT/GEOINT and intelligence methods for 
good. 









Join the Bellingcat Mailing List: 

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more. 
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Lars Fossen - Ma y 5, 2020 (https://www.bellin q cat.com/news/2020/05/05/uncoverin q -a-pro-chinese- q overnment-information- 
o peration-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269476 ) 

Thanks, again. 

You all make it "easy" to understand this weard world we live in. 


Reply 


Carlo - Ma y 5, 2020 (https://www.bellin q cat.com/news/2020/05/05/uncoverin q -a-pro-chinese- q overnment-information- 
o peration-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269506 ) 

Everyone suspects it, but you have proven it and provided insight in an orderly manner. Thanks! 


Reply 


Jeroen - Ma y 6, 2020 (https://www.bellin q cat.com/news/2020/05/05/uncoverin q -a-pro-chinese- q overnment-information- 
o peration-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269582 ) 

We have to adjust our lives not only to COVID-19 and other virus coming to us, but also these 
(dis)information malice and illness, we are targeted with. 

Thank you for showing us this. 


Reply 


Denis - Ma y 6, 2020 (https://www.bellin q cat.com/news/2020/05/05/uncoverin q -a-pro-chinese- q overnment-information- 
o peration-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269712 ) 

Great job! Exciting visuals ! A lot of screen names look like they were created by a password generator. 
This could used for training a ML classifier to identify fake accounts 


Reply 


Benjamin Strick - Ma y 7, 2020 (https://www.bellin q cat.com/news/2020/05/05/uncoverin q -a-pro-chinese- q overnment- 
information-operation-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269878 ) 

I agree with you Denis. It does look like a password generator indeed. 


Reply 


Rob - Ma y 6, 2020 (https://www.bellin q cat.com/news/2020/05/Q5/uncoverin q -a-pro-chinese- q overnment-information-operation- 
on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269760 ) 

Very nice analysis! I find the tweet with the user name Jeff Tiedrich to be an interesting connection. This 
is a pretty common scam I've seen on twitter where the username and icon are changed to a different 
commenter (normally one who is well known and has amassed a following) and used to push crypto 



scams. Makes me wonder if it implies this is an outsourced job and they're looking to make even more 
money with the accounts they've created. 


Reply 


Benjamin Strick - Ma y 7, 2020 (https://www.bellin q cat.com/news/2020/05/05/uncoverin q -a-pro-chinese- q overnment- 
information-operation-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269880 ) 

Thanks Rob. 

And yes you are definitely right. Actually there was an interesting pickup that I did not include in my 
analysis - some of the accounts in the network on April 30 had started retweeting and liking, en 
masse, a post from a hijacked account with a verification tick. I think it might have been a chef or 
someone. The account's user name and image was changed to mimic that of Elon Musk. 

Here's the tweet I did on it: https://twitter.com/BenDoBrown/status/1255882409486270465?s=20 
( httPs://twitter.com/BenDoBrown/status/1255882409486270465?s=20 ) 

I've seen this before in the crypto world quite frequently (as you also mentioned it is pretty common). 
Would be a good one to flag for follow up. 
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dive pridham - Ma y 6, 2020 (https://www.bellin q cat.com/news/2020/05/Q5/uncoverin q -a-pro-chinese- q overnment-information- 
o peration-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269768 ) 

Great investigation and reporting. 


Reply 


Fred - Ma y 6, 2020 (https://www.bellin q cat.com/news/2020/05/Q5/uncoverin q -a-pro-chinese- q overnment-information- 
o peration-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269783 ) 

Have you formally notified Twiiter and Facebook of your findings? You should! Thank you for your work. 


Reply 


Benjamin Strick - Ma y 7, 2020 (https://www.bellin q cat.com/news/2020/05/05/uncoverin q -a-pro-chinese- q overnment- 
information-operation-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269923 ) 

Hi Fred. I am sure Twitter have been notified of this. 

Not by me though. I'm just an analyst. 


Reply 


Loki Tam - Ma y 7, 2020 (https://www.bellin q cat.com/news/2020/05/05/uncoverin q -a-pro-chinese- q overnment-information- 
o peration-on-twitter-and-facebook-analvsis-of-the-miles q uo-bot-network/#comment-269842 ) 

Great job guy! 

Will you report it to twitter and facebook so that they can take further actions on this matter? 


Reply 
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